registry / livemerge-bridge / 0.2.0

livemerge-bridge@0.2.0

Local daemon that pairs your machine with the LiveMerge web app to receive Ed25519-signed task dispatches and run them via your local Claude Code or Codex CLI.

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs livemerge-bridge connect <pairingToken>.

Impact

A trusted LiveMerge signing authority can cause AI-agent changes in the chosen project.

Mechanism

Signed remote task dispatch to local AI-agent subprocesses.

Rationale

Source establishes a real remote AI-agent execution surface, but it is explicit, disclosed, constrained to allowlisted binaries, and signature-gated. No evidence shows credential harvesting, stealth persistence, or malicious lifecycle behavior.

Evidence

package.jsondist/cli.jsdist/dispatcher.jsdist/polling-client.jsdist/keyset.jsdist/state.js~/.livemerge-bridge/state.json~/.livemerge-bridge/keyset.json<project-dir>~/.livemerge-bridge/worktrees/<task-id>

Network endpoints4

livemerge.dev/api/pairing/handshake<server-url>/api/codewriter/dispatch

livemerge-bridge@0.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code